Analysis
-
max time kernel
152s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-11-2020 10:53
Static task
static1
Behavioral task
behavioral1
Sample
e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe
Resource
win7v20201028
General
-
Target
e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe
-
Size
872KB
-
MD5
17a37cac7b4b1b83008e2b293b149155
-
SHA1
ee960a8f4d618a99271bb3236fe5a6807a12a63d
-
SHA256
e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d
-
SHA512
f0dcde15c63a47abcfa4e5f4534134835ed4187d578e39f42d755aeee1936ed26ed1811f9960d1572d5d889bf20941b96f04702c3ca9b3c21c67afc48cc8785f
Malware Config
Extracted
Protocol: smtp- Host:
smtp.vivaldi.net - Port:
587 - Username:
moniman@vivaldi.net - Password:
manmoin@outlook.com
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
app.exeapp.exepid process 1172 app.exe 3784 app.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/1172-21-0x0000000005870000-0x0000000005874000-memory.dmp agile_net -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
app.exeapp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" app.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\Desktop\\app.exe -boot" app.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 21 whatismyipaddress.com 19 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
app.exeapp.exedescription pid process target process PID 1172 set thread context of 3784 1172 app.exe app.exe PID 3784 set thread context of 4040 3784 app.exe vbc.exe PID 3784 set thread context of 3788 3784 app.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 385 IoCs
Processes:
app.exepid process 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe 3784 app.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exeapp.exeapp.exedescription pid process Token: SeDebugPrivilege 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe Token: 33 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe Token: SeIncBasePriorityPrivilege 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe Token: SeDebugPrivilege 1172 app.exe Token: 33 1172 app.exe Token: SeIncBasePriorityPrivilege 1172 app.exe Token: SeDebugPrivilege 3784 app.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.execmd.exeapp.exeapp.exedescription pid process target process PID 508 wrote to memory of 3612 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe cmd.exe PID 508 wrote to memory of 3612 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe cmd.exe PID 508 wrote to memory of 3612 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe cmd.exe PID 508 wrote to memory of 416 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe cmd.exe PID 508 wrote to memory of 416 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe cmd.exe PID 508 wrote to memory of 416 508 e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe cmd.exe PID 416 wrote to memory of 1172 416 cmd.exe app.exe PID 416 wrote to memory of 1172 416 cmd.exe app.exe PID 416 wrote to memory of 1172 416 cmd.exe app.exe PID 1172 wrote to memory of 3784 1172 app.exe app.exe PID 1172 wrote to memory of 3784 1172 app.exe app.exe PID 1172 wrote to memory of 3784 1172 app.exe app.exe PID 1172 wrote to memory of 3784 1172 app.exe app.exe PID 1172 wrote to memory of 3784 1172 app.exe app.exe PID 1172 wrote to memory of 3784 1172 app.exe app.exe PID 1172 wrote to memory of 3784 1172 app.exe app.exe PID 1172 wrote to memory of 3784 1172 app.exe app.exe PID 3784 wrote to memory of 4040 3784 app.exe vbc.exe PID 3784 wrote to memory of 4040 3784 app.exe vbc.exe PID 3784 wrote to memory of 4040 3784 app.exe vbc.exe PID 3784 wrote to memory of 4040 3784 app.exe vbc.exe PID 3784 wrote to memory of 4040 3784 app.exe vbc.exe PID 3784 wrote to memory of 4040 3784 app.exe vbc.exe PID 3784 wrote to memory of 4040 3784 app.exe vbc.exe PID 3784 wrote to memory of 4040 3784 app.exe vbc.exe PID 3784 wrote to memory of 4040 3784 app.exe vbc.exe PID 3784 wrote to memory of 3788 3784 app.exe vbc.exe PID 3784 wrote to memory of 3788 3784 app.exe vbc.exe PID 3784 wrote to memory of 3788 3784 app.exe vbc.exe PID 3784 wrote to memory of 3788 3784 app.exe vbc.exe PID 3784 wrote to memory of 3788 3784 app.exe vbc.exe PID 3784 wrote to memory of 3788 3784 app.exe vbc.exe PID 3784 wrote to memory of 3788 3784 app.exe vbc.exe PID 3784 wrote to memory of 3788 3784 app.exe vbc.exe PID 3784 wrote to memory of 3788 3784 app.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe"C:\Users\Admin\AppData\Local\Temp\e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d.exe" "C:\Users\Admin\Desktop\app.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Desktop\app.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\app.exe"C:\Users\Admin\Desktop\app.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\app.exe"C:\Users\Admin\Desktop\app.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\app.exe.logMD5
b48c2a62e35da25ff5ae2a64627011fd
SHA1b9debb1739203670016e6595b34168172e8629b3
SHA2566c891b339b3f6ce349a719b8026a87d7969cd61ff1df3cdb373aea395c7d2727
SHA512d00a24aa026953fdaddf2f97a5418098d92c64a476656143b06235c5f135774696efd004aee9577c043c7099fa3d2b32d5d211058e04e5ca7e894acdc4b77367
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtMD5
f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\Desktop\app.exeMD5
17a37cac7b4b1b83008e2b293b149155
SHA1ee960a8f4d618a99271bb3236fe5a6807a12a63d
SHA256e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d
SHA512f0dcde15c63a47abcfa4e5f4534134835ed4187d578e39f42d755aeee1936ed26ed1811f9960d1572d5d889bf20941b96f04702c3ca9b3c21c67afc48cc8785f
-
C:\Users\Admin\Desktop\app.exeMD5
17a37cac7b4b1b83008e2b293b149155
SHA1ee960a8f4d618a99271bb3236fe5a6807a12a63d
SHA256e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d
SHA512f0dcde15c63a47abcfa4e5f4534134835ed4187d578e39f42d755aeee1936ed26ed1811f9960d1572d5d889bf20941b96f04702c3ca9b3c21c67afc48cc8785f
-
C:\Users\Admin\Desktop\app.exeMD5
17a37cac7b4b1b83008e2b293b149155
SHA1ee960a8f4d618a99271bb3236fe5a6807a12a63d
SHA256e9fcab6dd83ee8d52d0c26b72c5d7492261fd25e747501deb6e42a86155fc86d
SHA512f0dcde15c63a47abcfa4e5f4534134835ed4187d578e39f42d755aeee1936ed26ed1811f9960d1572d5d889bf20941b96f04702c3ca9b3c21c67afc48cc8785f
-
memory/416-9-0x0000000000000000-mapping.dmp
-
memory/508-5-0x0000000005290000-0x0000000005293000-memory.dmpFilesize
12KB
-
memory/508-0-0x0000000073520000-0x0000000073C0E000-memory.dmpFilesize
6.9MB
-
memory/508-7-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/508-6-0x00000000052B0000-0x00000000052B8000-memory.dmpFilesize
32KB
-
memory/508-4-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/508-3-0x0000000001440000-0x000000000146B000-memory.dmpFilesize
172KB
-
memory/508-1-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/1172-10-0x0000000000000000-mapping.dmp
-
memory/1172-13-0x0000000073520000-0x0000000073C0E000-memory.dmpFilesize
6.9MB
-
memory/1172-21-0x0000000005870000-0x0000000005874000-memory.dmpFilesize
16KB
-
memory/1172-22-0x0000000006340000-0x0000000006341000-memory.dmpFilesize
4KB
-
memory/3612-8-0x0000000000000000-mapping.dmp
-
memory/3784-27-0x0000000073520000-0x0000000073C0E000-memory.dmpFilesize
6.9MB
-
memory/3784-28-0x00000000005B0000-0x0000000000638000-memory.dmpFilesize
544KB
-
memory/3784-33-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/3784-34-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/3784-35-0x0000000007C40000-0x0000000007C41000-memory.dmpFilesize
4KB
-
memory/3784-36-0x0000000007F40000-0x0000000007F42000-memory.dmpFilesize
8KB
-
memory/3784-24-0x0000000000480BEE-mapping.dmp
-
memory/3788-41-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3788-42-0x0000000000442628-mapping.dmp
-
memory/3788-43-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4040-39-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4040-38-0x0000000000411654-mapping.dmp
-
memory/4040-37-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB